Embedded Security Engineer

About the role

Eagle Wireless is seeking an Embedded Security Engineer to join its R&D Automotive team. You will own the vulnerability‑management lifecycle for cellular module firmware, turning raw CVE data into actionable risk assessments and fixes across the full software stack.

Key responsibilities

• Scan and analyze CVE/OSS for each firmware release.
• Maintain an accurate SBOM covering open‑source and proprietary components.
• Determine exploitability of CVEs in our configuration and write risk dispositions.
• Prioritize and backport fixes, integrating Qualcomm security patches, TrustZone/QTEE, and bootloader updates.
• Verify end‑to‑end fixes through rebuilds, regression tests, and PoC exploit validation.
• Document patch history and feed information into release planning and notes.
• Support customer security questionnaires, audits, and regulatory compliance (UNECE R155, ISO/SAE 21434, etc.).
• Improve automation pipelines for CVE scanning, SBOM generation, and advisory alerts.

Required profile

• Degree in Computer Science, Electrical Engineering or related field.
• 3+ years of embedded Linux development with strong C/C++ coding.
• Hands‑on experience with Yocto/OpenEmbedded (BitBake recipes, layers.bbappend).
• Proven Linux kernel patching and backporting experience.
• Solid understanding of vulnerability classes, CVSS scoring and threat modeling for embedded systems.
• Strong troubleshooting skills using serial consoles, gdb and log analysis.
• Proficiency with Git and Gerrit in large multi‑repo codebases.

Required skills

• Embedded Linux
• C and C++
• Yocto / OpenEmbedded
• BitBake
• Linux kernel development
• CVE analysis
• Software Bill of Materials (SBOM)
• Git
• Gerrit
• Qualcomm security patches
• TrustZone / QTEE
• Bootloader integration
• Regression testing
• CI automation